Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug]: Wallet fails to indicate user is signing a non-existing contract #23568

Open
avious00 opened this issue Mar 18, 2024 · 4 comments
Open
Labels
T08-featureRequest team-confirmations Push issues to confirmations team team-confirmations-secure-ux DEPRECATED: please use "team-confirmations" label instead

Comments

@avious00
Copy link

Describe the bug

User was signing an interchain token transfer intended from inEVM, but due to a wagmi.sh network switching issue, ended up on zkSync. Metamask failed to prompt the user that they were signing a non-existing contract.

This issue has occurred multiple times with different users, causing meaningful financial loss:
zkSync etherscan: https://explorer.zksync.io/address/0x26f32245fCF5Ad53159E875d5Cae62aEcf19c2d4
Etherscan: https://etherscan.io/address/0x26f32245fCF5Ad53159E875d5Cae62aEcf19c2d4

Expected behavior

Indicate the presence of calldata for a call to a non-existing contract, and prevent users from signing non-existing contracts.

Screenshots/Recordings

No response

Steps to reproduce

https://discord.com/channels/935678348330434570/1217928354871640187/1217928354871640187

Error messages or log output

No response

Version

Unknown

Build type

None

Browser

Other (please elaborate in the "Additional Context" section)

Operating system

Other (please elaborate in the "Additional Context" section)

Hardware wallet

No response

Additional context

No response

Severity

No response

@danjm danjm added team-confirmations-planning (only for internal use within Confirmations team) Sev1-high High severity; partial loss of service with severe impact upon users, with no workaround. labels Mar 19, 2024
@pedronfigueiredo
Copy link
Contributor

Thanks for reporting this, @avious00. I can't open the reproduction steps on Discord. Can you clarify what server and channel this is reported on and include an invite link, if possible, so that we can look into it?

@bschorchit
Copy link

Could you add the reproduction steps to this issue @avious00 ?

@bschorchit bschorchit added team-confirmations-secure-ux DEPRECATED: please use "team-confirmations" label instead T08-featureRequest and removed Sev1-high High severity; partial loss of service with severe impact upon users, with no workaround. team-confirmations-planning (only for internal use within Confirmations team) type-bug labels Mar 19, 2024
@bschorchit
Copy link

This seems to be an issue caused by not properly triggering a network switch request ahead of the transaction request as reported here. For this reason I removed the bug label as it's not a MetaMask bug, but I'm keeping this issue open as a feature request as we do want to consider this for a potential improvement to the wallet.

@avious00
Copy link
Author

hey @bschorchit @pedronfigueiredo appreciate the quick response here

in the reproduction section, linked the discord report of a user who experienced this problem.

the rough steps to reproduce are:

  1. Visit https://www.usenexus.org/ - a bridging UI for Hyperlane
  2. Attempt a transaction while being on zkSync Era
  3. This should usually automatically switch over because of our use of the wagmi lib, but this can fail. Users usually don't catch that this has not gone through.
  4. If this failure mode occurs, which it has for a meaningful amount of our users and I assume other defi apps, a tx gets submitted by MM to a non-existent contract, burning their fees.

Regardless of the contract switching bug (which isn't material here), MM should in general prevent tx being signed to non-existent contracts.

@cryptotavares cryptotavares added the team-confirmations Push issues to confirmations team label Apr 24, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
T08-featureRequest team-confirmations Push issues to confirmations team team-confirmations-secure-ux DEPRECATED: please use "team-confirmations" label instead
Projects
Status: To be fixed
Development

No branches or pull requests

5 participants